Avast 7 and Comodo Firewall

[Hopper15]

Not having any problems with my comodo firewall

[dcross]

I'm running Win 7 64 bit and it happened to me too: Comodo was saying it was blocking what I told it to, but Avast was letting it right through (unless I turned Web Shield off). I've since reinstalled V6 and the firewall seems to be working as it should once again. Looks like it's only happening on Win 7 and Win 2000 machines.

[NON]

If you enable "Scan traffic from well-known browser processes only" in Web Shield Expert Settings, this behavior should be changed.
This option is disabled by default, and with default settings all traffic via port 80 and some are redirected to AvastSvc.exe and firewall cannot stop them.
If you want to use firewall effectively, you have to enable this option.

[SamHui]

I already tried the various options in the webshield settings to no avail.  Currently the only way I can see that enables Comodo firewall to work is by disabling webshield.  It does look like that all the traffic is being transferred through AvastSvc.exe.  If I block Avastsvc.exe through Comodo Firewall, then all the programs that requires internet access like firefox, internet explorer, mbam,  etc. would not work.  The programs won't even ask for permission, it just straight out does not connect when Avastsvc.exe is blocked in Comodo.  Using Windows 7 32bit. Thanks.

[AveSulla]

"Scan traffic from well-known browser processes only" works for me too, comodo block internet access again (Win 7 64 bit)

[mchain]

Hi Iroc,

My Comodo firewall working OK here. Did you check if you still have your exclusions for each other progs in place after the upgrade ?

The only exclusions I have are in Avast. Excluded are cmdagent memory process and the Comodo install folder.

Have you tested properly?

Clear your Comodo rules and block your browser and see if you can access webpages.

Glad I came across this topic.  No idea whatsoever.

As a test, I changed the rules for FF from Web Browser to Blocked Application.  FF would not connect.  Changed back again to Web Browser, connectivity back.  Could this bug be OS specific?  Maybe just Win7?  Does anyone see a pattern here?

[cyberrufus]

If you enable "Scan traffic from well-known browser processes only" in Web Shield Expert Settings, this behavior should be changed.
This option is disabled by default, and with default settings all traffic via port 80 and some are redirected to AvastSvc.exe and firewall cannot stop them.
If you want to use firewall effectively, you have to enable this option.

Had the same problem with webshield with the Windows 7 firewall and this is the fix.

[Hellion]

Hi All,

I would just like to report back on my findings...

I added all Exclusions mentioned by Iroc and I enabled the "scan well known browser processes only" and my situation has not changed.

Firefox blocked, but I can browse freely.

Windows 7 Home Premium x64 | Comodo latest | Avast latest

[NON]

Hi All,

I would just like to report back on my findings...

I added all Exclusions mentioned by Iroc and I enabled the "scan well known browser processes only" and my situation has not changed.

Firefox blocked, but I can browse freely.

Windows 7 Home Premium x64 | Comodo latest | Avast latest

Firefox is "well-known browser" so avast redirects Firefox's connection even with "scan well known browser processes only" enabled.
I remember there is an option called "Excluded processes" in Web Shield settings, so if you exclude firefox.exe then you could block Firefox by Comodo. Of course, web shield doesn't work with this settings.

[Hellion]

Hi NON,

I want to be able to control my applications, but also receive maximum protection from Avast.

EDIT: Another Comodo thread where Avast 7 has rendered a user's FW useless - https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.0.html

[Hellion]

Hi all,

Sorry for double post, but no one has responded in 24 H.

This is a really big security issue!

[NON]

Set Firefos's proxy settings to localhost:12080, then Comodo can block firefox connection.
localhost:12080 means Web Shield, so Web Shield can scan Firefox traffics.

I would say this is how Web Shield works, so it can't be helped if you want further control.
At least I don't know the way to do it.
And I don't see any reason to manually allow/block Firefox connections...

[DogStar]

Just thought I'd let you know the problem's not confined to Comodo firewall, it also happens with the Windows 7 firewall and it's not just about firefox. You can easily try this.

Install Avast 7 and make sure everything works correctly
Change the properties of the Windows 7 firewall profiles, so that 'Outbound connections that do not match a rule are blocked'
Try to make a connection with a browser - it should fail because there's no rule to allow the connection.
Now add a rule to allow AvastSvc.exe to make outbound connections.
Reopen you browser and try to make a connection. This time it will succeed, even though it still doesn't have a rule of it's own.
Now open any application that uses a direct connection over TCP port 80 for updates and try to update. It will also succeed, again without an explicit rule

These connections work because they being routed through the Avast proxy and it shouldn't be happening this way, it's making a mockery of the firewall(s). There again, the firewall(s) should be able to block these connections...

Edit: If an explicit block rule, for the browser, is added to the firewall, connections can still be made. This is in a firewall where block rules take precedence over allow rules.

If anyone has tried any other firewalls it would be good to know if they also allow these connections.

[Hellion]

Hi Dogstar,

Please view this post in the Comodo forums.

Radaghast did some tests with Firewalls - https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.15.html

[DogStar]

Hi Dogstar,

Please view this post in the Comodo forums.

Radaghast did some tests with Firewalls - https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.15.html

Thanks, I'll take a look.